Splunk Search

How do you use regex on 2 fields and combine them into one field for an xyseries?

krusovice
Path Finder

Hi all,

I have a simple regex to extract 2 fields — name1 and name2. And I would need to combine it like this: name1.name2 and send it to xyseries as one name. I can't make it work with the below query.

| rex "line1\=(?<name1>[\w+]+)" 
| rex "line2\=(?<name2>[\w+]+)"
| eval fullname=name1.name2
| xyseries fullname date_hour count

Could someone please help me? Thank you in advance.

Tags (1)
1 Solution

bjoernjensen
Contributor

Hey,

most probably you have some NULL values. Use fillnull with an appropriate value (could also be NULL not an empty string as below):

| rex "line1\=(?<name1>[\w+]+)" 
| rex "line2\=(?<name2>[\w+]+)"
| fillnull name1 value=""
| fillnull name2 value=""
| eval fullname=name1.".".name2
| xyseries fullname date_hour count

Additionally this will actually add a dot . between name1 and name2

If that is not working... please provide the result without the last xyseries ...

Hope that helps,
Björn

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Is there a reason for using xyseries with date_hour instead of timechart span=1h?
The date_foo fields are often trouble.

0 Karma

bjoernjensen
Contributor

Hey,

most probably you have some NULL values. Use fillnull with an appropriate value (could also be NULL not an empty string as below):

| rex "line1\=(?<name1>[\w+]+)" 
| rex "line2\=(?<name2>[\w+]+)"
| fillnull name1 value=""
| fillnull name2 value=""
| eval fullname=name1.".".name2
| xyseries fullname date_hour count

Additionally this will actually add a dot . between name1 and name2

If that is not working... please provide the result without the last xyseries ...

Hope that helps,
Björn

0 Karma

krusovice
Path Finder

Thank you, you have given some clue how to fix my SPL. Thank you.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@krusovice

Can you please share you sample events?

0 Karma

krusovice
Path Finder

raw data like this:

line1=aaa
line2=yyy

Expected fullname should be aaa.yyy in x-axis of the table.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@krusovice

As per you given event, name1 and name2 are in separate event. So you have to make it in single event by aggregating. like using stats values

| stats values(name1) as name1 values(name2) as name2 by date_hour

here if you have any unique id for both events then you have to use it in by clause.

| stats values(name1) as name1 values(name2) as name2 by <<UNIQUE_ID>>

For reference see below search.

| makeresults 
| eval _raw="line1=aaa" 
| append 
    [| makeresults 
    | eval _raw="line2=yyy"] | eval ID=10 | eval date_hour=10
| rex "line1=(?<name1>[\w+]+)" 
| rex "line2=(?<name2>[\w+]+)"  
| stats values(name1) as name1 values(name2) as name2 count by ID date_hour
| eval fullname=name1.".".name2
| xyseries fullname date_hour count

Thanks

0 Karma

prakash007
Builder

How about this..

| rex "line1\=(?<name1>[\w+]+)" 
| rex "line2\=(?<name2>[\w+]+)"
| eval fullname=name1." ".name2
| xyseries fullname date_hour count

krusovice
Path Finder

Hi @prakash007,

Thanks for reply, it is not working.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...